I think there are two different questions being asked here so I'll address them separately.
Question 1: Is the SMTP Banner required to display unmasked for other mail servers to use TLS?
Answer: No, the SMTP greeting banner itself does not determine eligibility for TLS. So if that's the ONLY thing that is masked, it shouldn't cause an issue.
Question 2 (Paraphrased): Is the firewall interfering with incoming TLS connections?
Answer: Most likely. In addition to masking the greeting banner, the fixup/esmtp inspection service on Cisco Firewalls typically only accepts specific commands.
I'm not sure what version/model firewall you're using but as per this tech note:
ESMTP inspection operates in the same way that SMTP inspection does.
Packets with illegal commands are modified to an "xxxx" pattern and
forwarded to the server, which triggers a negative reply. An illegal
ESMTP command is any command except for these commands:
AUTH
DATA
EHLO
ETRN
HELO
HELP
HELP
MAIL
NOOP
QUIT
RCPT
RSET
SAML
SEND
SOML
VRFY
When external servers connect and issue the ehlo
SMTP command, they'll see a list of SMTP services/options supported. Assuming they see 250-STARTTLS
the sending server will issue a STARTTLS
command to begin the attempt to use TLS. You'll notice that this command isn't included in the list of commands above.
So in summary, I suspect that your firewall IS interferring but not because of the banner greeting. I think it's blocking/masking the STARTTLS command from the remote mail server.